<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I wanted to give everyone a concrete example of what I was talking about last week about how HEART style scopes would fit into XYZ’s model of resource requests. The way I see it, each of the different parts of the scope set in HEART would end up as a different field in the resources object. So I think we would end up with something like:<div class=""><br class=""></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><font face="Courier New" class="">{</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>permission: “patient”, <b class="">// could be “user” instead for bulk requests</b></font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>datatypes: [</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>“Patient”, “MedicationStatement”, “Observation”, …. <b class="">// these are FHIR resource types, we might want a “*” here as well</b></font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>],</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>access: [</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>“read”, “write” <b class="">// we might want “*” here as well</b></font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>],</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>locations: [</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>“<a href="http://fhir.example.org/records/" class="">http://fhir.example.org/records/</a>“ <b class="">// the FHIR API endpoint root</b></font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>],</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>confidentiality: [</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>“N”, “R”, … <b class="">// confidentiality flags</b></font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>],</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>sensitivity: [</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>“HIV”, “SEX”, “RACE”, … <b class="">// sensitivity flags</b></font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>],</font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>break_the_glass: true, <b class="">// this can turn into a simple flag instead of a separate scope now that we separate it out</b></font></div><div class=""><font face="Courier New" class=""><span class="Apple-tab-span" style="white-space:pre"> </span>identifier: “patient-12345” <b class="">// this is the patient identifier as known by the client, may or may not be the same as used internally</b></font></div><div class=""><font face="Courier New" class="">}</font></div></blockquote><div class=""><br class=""></div><div class=""><br class="">
So you can see here that we no longer have “read:patient/Patient” and the like, and the AS/RS no longer need to parse the scope string to figure out what’s going on in there.</div><div class=""><br class=""></div><div class="">You can do the same kinds of thing with the proposed RAR scope in the OAuth WG, which is based on XYZ’s structure.</div><div class=""><br class=""></div><div class=""> — Justin</div></body></html>